Faster filtering for unavailable indices

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/IndicesAndAliasesResolver.java

@@ -35,6 +35,7 @@
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
+import java.util.ListIterator;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
@@ -124,12 +125,13 @@ ResolvedIndices resolveIndicesAndAliases(String action, IndicesRequest indicesRe
                     : "indices are: " + Arrays.toString(indicesRequest.indices()); // Arrays.toString() can handle null values - all good
             resolvedIndicesBuilder.addLocal(getPutMappingIndexOrAlias((PutMappingRequest) indicesRequest, authorizedIndices, metadata));
         } else if (indicesRequest instanceof IndicesRequest.Replaceable) {
+            final String[] indices = indicesRequest.indices();
             final IndicesRequest.Replaceable replaceable = (IndicesRequest.Replaceable) indicesRequest;
             final IndicesOptions indicesOptions = indicesRequest.indicesOptions();
             final boolean replaceWildcards = indicesOptions.expandWildcardsOpen() || indicesOptions.expandWildcardsClosed();
 
             // check for all and return list of authorized indices
-            if (IndexNameExpressionResolver.isAllIndices(indicesList(indicesRequest.indices()))) {
+            if (IndexNameExpressionResolver.isAllIndices(indicesList(indices))) {
                 if (replaceWildcards) {
                     for (String authorizedIndex : authorizedIndices) {
                         if (IndexAbstractionResolver.isIndexVisible("*", authorizedIndex, indicesOptions, metadata, nameExpressionResolver,
@@ -143,16 +145,22 @@ ResolvedIndices resolveIndicesAndAliases(String action, IndicesRequest indicesRe
             } else {
                 final ResolvedIndices split;
                 if (indicesRequest.allowsRemoteIndices()) {
-                    split = remoteClusterResolver.splitLocalAndRemoteIndexNames(indicesRequest.indices());
+                    split = remoteClusterResolver.splitLocalAndRemoteIndexNames(indices);
                 } else {
-                    split = new ResolvedIndices(Arrays.asList(indicesRequest.indices()), Collections.emptyList());
+                    split = new ResolvedIndices(Arrays.asList(indices), Collections.emptyList());
                 }
                 List<String> replaced = indexAbstractionResolver.resolveIndexAbstractions(split.getLocal(), indicesOptions, metadata,
                         authorizedIndices, replaceWildcards, indicesRequest.includeDataStreams());
+
+                assert indices != null && indices.length != 0 : "null or empty indices should be handled by isAllIndices";
+                // Filtering is needed only if the request needs filter out unavailable indices
                 if (indicesOptions.ignoreUnavailable()) {
                     //out of all the explicit names (expanded from wildcards and original ones that were left untouched)
                     //remove all the ones that the current user is not authorized for and ignore them
-                    replaced = replaced.stream().filter(authorizedIndices::contains).collect(Collectors.toList());
+                    final List<String> filtered = filterOutUnavailable(authorizedIndices, replaced);
+                    if (filtered != null) {
+                        replaced = filtered;
+                    }
                 }
                 resolvedIndicesBuilder.addLocal(replaced);
                 resolvedIndicesBuilder.addRemote(split.getRemote());
@@ -167,7 +175,7 @@ ResolvedIndices resolveIndicesAndAliases(String action, IndicesRequest indicesRe
                     indicesReplacedWithNoIndices = true;
                     resolvedIndicesBuilder.addLocal(NO_INDEX_PLACEHOLDER);
                 } else {
-                    throw new IndexNotFoundException(Arrays.toString(indicesRequest.indices()));
+                    throw new IndexNotFoundException(Arrays.toString(indices));
                 }
             } else {
                 replaceable.indices(resolvedIndicesBuilder.build().toArray());
@@ -244,6 +252,28 @@ ResolvedIndices resolveIndicesAndAliases(String action, IndicesRequest indicesRe
         return resolvedIndicesBuilder.build();
     }
 
+    private List<String> filterOutUnavailable(Set<String> authorizedIndices, List<String> replaced) {
+        // Avoid creating filtered list if all replaced indices are available.
+        // Also avoid resizing the filtered list by creating the list with sufficient size in the beginning.
+        List<String> filtered = null;
+        for (ListIterator<String> itr = replaced.listIterator(); itr.hasNext();) {
+            final String index = itr.next();
+            if (authorizedIndices.contains(index) == false) {
+                // Only creating the filtered list when there are unavailable indices
+                if (filtered == null) {
+                    filtered = new ArrayList<>(replaced.size() - 1);
+                    filtered.addAll(replaced.subList(0, itr.previousIndex()));
+                }
+            } else {
+                if (filtered != null) {
+                    filtered.add(index);
+                }
+                // If filtered is null that means all indices so far is available, so no need to filter
+            }
+        }
+        return filtered;
+    }
+
     /**
      * Special handling of the value to authorize for a put mapping request. Dynamic put mapping
      * requests use a concrete index, but we allow permissions to be defined on aliases so if the

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/IndicesAndAliasesResolverTests.java

@@ -695,7 +695,7 @@ public void testResolveNoExpandStrict() {
     }
 
     public void testResolveNoExpandIgnoreUnavailable() {
-        SearchRequest request = new SearchRequest("missing*");
+        SearchRequest request = new SearchRequest(randomFrom("missing*", "*"));
         request.indicesOptions(IndicesOptions.fromOptions(true, true, false, false));
         assertNoIndices(request, resolveIndices(request, buildAuthorizedIndices(user, SearchAction.NAME)));
     }